Anthropic is making Auto Mode the default for new Claude Code sessions on paid plans starting August 14 — a shift that replaces human approval clicks with AI classifiers that screen every agent action for danger.
Auto Mode, detailed in a new Anthropic engineering post, sits between a safe but high-maintenance sandbox and the --dangerously-skip-permissions flag that disables prompts entirely. Two layers defend the agent: a server-side prompt-injection probe scans tool outputs before they reach the agent's context, and a transcript classifier running on Sonnet 4.6 evaluates each action before it executes, using a fast filter followed by chain-of-thought reasoning only when something is flagged. The classifier deliberately sees only user messages and tool calls, making it "reasoning-blind" so an agent cannot talk its way past the guardrails.
In internal evaluations, the pipeline blocked 99.6% of benign actions correctly, caught 83% of real overeager actions and 94.3% of synthetic data-exfiltration attempts. Blocked actions force the agent to find a safer path; after three consecutive or 20 total denials, a human takes over. Anthropic has also let Claude Code sessions message each other directly, so parallel sessions can share context across terminals and machines.
